Detected compromise of the official add-on Claude Code for VS Code, supplied by Anthropic and numbering 63 million downloads The attackers managed to place in the Open-VSX directory the release [email protected] containing malicious code for remote access to the user’s system. The publication of a malicious version of the package in the Microsoft repository has not been confirmed, but a report with a warning has also been generated for it. Currently, the problematic version has been removed from the Open-VSX repository and a corrective release 2.1.314 has been published.
Code for loading malicious components was added to the beginning of the extension.js file and was activated when the add-on was initialized after launching VS Code (user interaction with Claude was not required to activate the malicious code). The malicious activity consisted of creating the ~/.ssh directory and adding the public key ssh-ed25519 with the note “svc-telemetry” to the file ~/.ssh/authorized_keys. After this, the presence of the background sshd process in Linux and macOS was checked, and the SSH server was activated if it was absent. On Windows, OpenSSH was installed via PowerShell.
Next, the malicious code saved the private key to a temporary file called “.stk_*” and set up a reverse tunnel with an external SSH server 134.209.82.225 for remote access by running ssh with the “-N -R ‘*:0:localhost:22′” options. The connection was refreshed every 60 seconds. Scripts for updating the tunnel and sending data to external servers were saved in the ~/.config/.smt and ~/.config/.smtk files. Periodic launch on Linux was configured via cron, on macOS via LaunchAgent (com.apple.sysmond.plist), and on Windows via SysMon and autostart.
In addition, the system collected information about the host name, registered users, operating system, home directory, email (via git config –global user.email) and environment variables with names containing the words KEY, TOKEN, SECRET, PASS, AWS and GCP. The found data was sent in JSON format to the URL https://134.209.82.225:8099/beacon.
Users of the Claude Code add-on for VS Code are advised to check their systems for malicious version 2.1.313. Indicators of system compromise are the appearance of the files ~/.config/.smt, ~/.config/.smtk, ~/Library/LaunchAgents/com.apple.sysmond.plist, ${TMPDIR}/.stk_*, ~/.config/smt.cmd,
~/.config/smtk, SysMon and sysmon.cmd, as well as calling on ports 22 and 8099 to the IP address 134.209.82.225, and sending HTTP/HTTPS requests to the hosts ifconfig.me and api.ipify.org.
How exactly the attackers managed to insert malicious code into the addition is not yet clear, it is assumed that it could have been hacked the account of an Anthropic employee maintaining the package, or a security issue in the release publishing system was exploited.